You can set up sendmail so that unsolicited or spam mail (unsolicited mail sent to large numbers of users) is not transmitted through or received by users on the network.
The first step in configuration is to enable the anti-spamming rulesets. You then edit other configuration files to control mail transmission. This section describes how you can:
Accept or reject mail from particular senders
Prevent your machine from being used as a relay machine
Accept or reject connections from specific users hostnames based on domains, or IP addresses
Enable or disable mail transfers from specific senders and recipient pairs
Open the sendmail configuration file, sendmail.cf.
Uncommenting the following rulesets located between #Begin Anti-Spamming and #End Anti-Spamming in the sendmail.cf file.
check_mail
check_rcpt
check_relay
check_compat
By default sendmail accepts mail from all users and all domains. You can set up sendmail to filter mail using the sender's address in the SMTP MAIL FROM command. You can use the check_mail ruleset to refuse or reject mail messages from specific users or domains. To specify users and domains from whom you do not want to receive mail messages, edit the /etc/Mail/Spammer and /etc/Mail/SpamDomains files.
Enter the user's complete mail address into the /etc/Mail/Spammer file.
 |
sally@cup.hp.com |
|
All messages from Sally and John will be rejected.
Enter the domain address into the /etc/Mail/SpamDomain file.
|
pests.com |
|
Mail messages received from all users in the pests domain and all users in the rose.hp.com domain, not just John, will be rejected.
Enter the name of the host from which you do not want to receive messages into the /etc/Mail/SpamDomain file.
|
bobcat.rose.hp.com |
|
Mail from any user on the host bobcat in the rose.hp.com domain and from the host cheetah in the india.hp.com domain will be rejected. You will not receive messages from this host.
You can allow your machine to be used as a relay agent to other machines. By specifying who you wish to be a relay for, you eliminate the indiscriminate use of your machine as a relay for spammers, who may pass unsolicited mail from and to other networks through your machine.
You can use the ruleset check_rcpt to validate the sender-envelope address given to the SMTP RCPT command (the address in the "To" field of the SMTP RCPT command)
Because this ruleset is employed, when a message is sent, it checks that either the connecting SMTP client is "local" or the recipient is a host for which the mailhost acts as a relay or both. Local refers to any domain listed in /etc/mail/LocalIP or /etc/Mail/LocalNames.
You can identify hosts for which you are willing to receive and forward mail messages either by IP address or hostname.
| |
| |
| |
 | NOTE: You cannot specify domain names here. |
| |
| |
| |
Enter the IP address of the local hosts for which you are willing to act as a relay host in the file /etc/Mail/LocalIP.
199.28.9.20
199.32.7.15Mail messages sent from or to the local host whose IP address you enter in the file will be accepted.
Enter the hostname of the local host for which you will act as a relay host for in the file /etc/mail/LocalNames.
For example, if you enter the following, mail sent to or from these hosts will be sent accepted for relaying through the mail server.
bobcat
tulip.india.hp.com
rose.hp.com
You can allow external mail messages to be routed through your machine or you can set it so external messages are not relayed through your machine. By default, external messages are not allowed to pass through your machine.
Enter the external domain you will accept and deliver messages for in the /etc/Mail/RelayTo file.
For example, enter hp.com to relay messages for the domain, hp.com. By specifying hp.com, if a user from aol.com tries to send a mail message to a user in another external domain like hotmail.com, through your mail hub, then the hub will reject the mail message.
The check_relay ruleset allows you to examine incoming network connections and accept or reject them based on hostnames, domain, or IP addresses.
To reject relay access to specific hosts, specify the IP address of the host in the /etc/Mail/DeniedIP file.
|
15.10.43.248 |
|
You can also specify the name of the host you want to deny access in the file /etc/Mail/DeniedNames. You must enter the Fully Qualified Domain name, for example, bobcat.rose.hp.com.
The check_compat ruleset compares all senders and receiver pairs before mail is delivered. It validates the mail based on the results of the comparison. It checks to see if host A can legally send a message to host B. check_compat is called for all mail deliveries, not just SMTP transactions.
It is used in the following situations:
A set of users who are restricted from sending mail messages to external domains need to send mail messages to internal; domains. Both the sender and recipient addresses are checked to ensure that they are in the local domain.
A particular user needs to ensure that he or she does not receive mail messages from a specific source.
A particular host needs to ensure that external senders do not use that host as a a mail relay. The mail messages are screened based on the sender's hostname.
The anti-spamming features enable you to control which users can send, receive, or relay mail messages on the network. Sendmail provides the following features:
You must run the gen_cf script to turn on relaying, validating, and checking features.
The access database also allows you to control the message flow. See the section “Using the Access Database to Allow or Reject Mail Messages” for more information.
You can control the flow of mail messages coming in from certain domains. The Access Database gives you the ability to allow or reject mail from specific domains. By default, names listed in the database as "OK" are domain names, not host names.
The primary steps to allow or reject messages include:
Step 1. Creating an Access Database text fileStep 2. Creating a Database map You should understand a few basic facts about the Access Database format and structure before creating the Access Database file or database map.
This section includes a few key points about the database and describes the format of the database.
Every line of the access database file has a key and a value pair.
The value part of the database can be any of the following as listed in Table 4-4 “Access Database Format”.
The key can be an IP address, a domain name, a hostname or an e-mail address.
Table 4-4 Access Database Format
Value | Description |
|---|---|
OK | Accepts mail even if other rules if the running ruleset rejects it. For example, if the domain name is unresolvable. |
RELAY | Accepts mail addressed to the specified domain or received from the specified domain for relaying through your SMTP server. RELAY also serves as an implicit OK for the other checks. |
REJECT | Rejects the sender or recipient with a general purpose message. |
DISCARD | Discards the message completely using the $#discard mailer delivery agent. This only works for sender addresses. That is, it indicates that you should discard anything received from the specified domain. |
### "any text" | Where ### is an RFC 821 compliant error code and "any text" is a message to return for the command. |
You must edit the Access Database file manually. The default Access Database file is /etc/mail/access. However, you can specify another file in the sendmail.cf file.
Below is a sample access database file, /etc/mail/access.
Table 4-5 Access Database Text File Example
| cyberspammer.com | 550 We don't accept mail from spammers |
okay.cyberspammer.com | OK |
128.32 | RELAY |
spammer@aol.com | REJECT |
192.168.212 | DISCARD |
In the above Access Database file, all mail messages from the cyberspammer.com domain are rejected and the error message "550 We don't accept mail from spammers" is displayed. All mail messages from the okay.cyberspammer.com domain are accepted. Messages can be relayed through 128.32. All mail messages from spammer@aol.com are rejected. All mail messages from the 192.168.212 domain are discarded.
After creating the text file, you must use makemap to create the database map. Type the following command to make the database:
makemap hash /etc/mail/access < /etc/mail/access
The makemap utility takes /etc/mail/access file as input. It then stores the results back into the /etc/mail/access.db file.
The gen_cf shell script distributed with Sendmail allows you to turn on one or more of the relay anti-spamming features listed below. These capabilities are described in this section.
Promiscuous relay allows you to configure your site to allow mail relaying from any one site to any other site. This feature is not enabled by default.
You can enable promiscuous relay by selecting it as an option when running the gen_cf script distributed with this release. By enabling this option Sendmail does not check for relaying. Spammers may then relay mail through your site.
By default only hosts listed as RELAY in the Access Database are allowed to relay messages. The hosts must be defined in the m class ($=m) macro to relay. However, this feature allows any host in your domain to relay mail messages.
By default, host names that are listed as RELAY in both the Access Database and the class 'R' ($=R) macro can relay messages. When using this feature, specify hostnames. This feature enables Sendmail to look up individual host names and relay messages to the host.
This feature allows relaying based on the MX records of the host portion of an incoming recipient. If a MX record for host foo.com points to your site, you will accept and relay mail addressed to foo.com.
With this feature, a sender, who is a valid user on a particular host, can relay messages to other users on different hosts.
Caution: Use caution when using this feature. Using it opens a window for spammers. Specifically, spammers can send mail to your mail server that claims to be from your domain (either directly or via a routed address), and your machine will relay it out to any hosts on the Internet.
Sendmail provides a stricter check of mail message senders to ensure they are legitimate. Sendmail will refuse mail if the MAIL FROM: parameter has an unresolvable domain. You can work around this. If you want to continue accepting mail from such domains, use the features described in this section. Any of these features can be enabled when you run the gen_cf script, which is distributed with Sendmail.
Accept Unresolvable Domain
Accept Unqualified Senders
Black list Recipients
Real-time Blackhole List
This feature enables sendmail to accept all MAIL FROM: parameters that are not fully qualified. For example, a mail message whose host part of the argument to the MAIL FROM: parameter cannot be located in the host name service, such as DNS.
This feature allows you to accept all mail where the sender's mail address does not include a domain name.
Normally, the MAIL FROM: commands in the SMTP session will be refused if the connection is a network connection and the sender address does not include a domain name.
This feature enables sendmail to block incoming mail messages destined for certain recipient user names, hostnames, or addresses. This feature also restricts you from sending mail messages to addresses with an error message or REJECT value in the Access Database file.
Example 1For example, given the following entries in the Access Database file:
|
badlocaluser 550 Mailbox disabled for this |
|
Recipient of badlocaluser@mydomain.com, any user at host.mydomain.com, and the single address user@otherhost.mydomain.com will not receive mail.
Example 2
spammer@aol.com REJECT
cyberspammer.com REJECT
Mail can't be sent to spammer@aol.com or anyone at cyberspammer.com.
This feature will reject hosts listed in the Real-time Blackhole List, which is found in the Real-time Blackhole List server. The server is rbl.maps.vix.com.To use this feature, you must add the following to the DNS database:
1.5.5.192.rbl.maps.vix.com. IN A 127.0.0.2
You can specify the Real-time Blackhole List servers in the sendmail.cf file.
With header checking, mail messages can be rejected based on the contents of their mail headers. Sendmail provides the syntax for limited header syntax checking. A config line of the form: HHeader: $>Ruleset causes the specified ruleset to be invoked on the Header when read. Below is an example of header checking:
|
Validity of a Message-ID: header |
|
If the above lines are included in the sendmail.cf file then, all header messages of the form "Message-Id:" will call the ruleset SCheckMessageID, which checks the validity of the Message-Id header.
Sendmail has defined a special internal delivery agent called discard. This agent can be used with the header checking ruleset and "check" rulesets: check_mail, check_rcpt, check_relay, or check_compat.
If any of the "check" rulesets (check_mail, check_rcpt, check_relay, or check_compat) or the header checking ruleset resolves a mail address to the $#discard mailer, then all the SMTP commands will be accepted, but the message will be discarded. If only one of message recipients address resolves to the $#discard mailer, none of the recipients will receive the mail message.
You can use regular expressions with the new map class "regex." The regex map can be used to see if an address matches a certain regular expression. By using such a map in a "check" rulesets (check_mail, check_rcpt, check_relay, or check_compat), you can block a certain range of addresses that would otherwise be considered valid.
For example, if you want to block all senders with all numeric user names, such as 2312343@bigisp.com, you would use SLocal_check_mail and the new regex map:
|
#LOCAL_CONFIG |
|
You can use the $=R macro to define the hosts that are allowed to relay. The default file sendmail uses to read values for the $=R macro is /etc/mail/relay-domains.
This section describes miscellaneous enhancements to the queue option:
Allow multiple -qI, -qR, or -qS queue run limiters
For example, using sendmail -qRfoo -qRbar will deliver mail to recipients with foo or bar in their address.There is a new map flag "-Tx" appends "x" to lookups that return temporary failure. This is similar to "-ax" flag which appends "x" to lookups that return success.
The "QueueSortOrder" option is case sensitive.
REFERNCE
http://docs.hp.com/en/B2355-90685/ch04s09.html
